#!/bin/sh
# DF-3443 full in-guest verification flow (run from the host repo root).
# Usage: sh findings/poc/DF-3443/guest_flow.sh <plain|spray|nodestroy> [noflush]
# Assumes guest is UP. Builds PoC + ALTQ-enabled pf.ko (kernel already has
# priq_* compiled in via 'options ALTQ_PRIQ'), then runs the sequence.
set -e
MODE="${1:-plain}"
cd /home/maxx/dfbsd/dfbsd
SCP="scp -F dfbsd-qemu/config -o ConnectTimeout=8"

$SCP findings/poc/DF-3443/df3443_poc.c dfbsd:/root/df3443_poc.c
dfbsd-qemu/vm.sh run_root '
	set -e
	cd /root
	cc -O -w -o df3443_poc df3443_poc.c -I/usr/src/sys
	kldload pf 2>/dev/null || true
	kldload if_tap 2>/dev/null || true
	# rebuild pf.ko with ALTQ (stock module lacks the ALTQ ioctl glue)
	if [ ! -f /usr/src/sys/net/pf/pf.ko ]; then
		( cd /usr/src/sys/net/pf && \
		  make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC \
		  >/root/pfbuild.log 2>&1 )
	fi
	kldstat | grep -q "pf.ko" && kldunload pf 2>/dev/null || true
	kldload /usr/src/sys/net/pf/pf.ko
	ifconfig tap0 create up 2>/dev/null || true
	ifconfig tap0 >/dev/null
	echo READY
'
echo "=== RUNNING POC (mode=$MODE) ==="
dfbsd-qemu/vm.sh run_root "cd /root && timeout 40 ./df3443_poc tap0 $MODE; echo POC-RC=\$?"